Systems Audit and Control
Final Exam
Course Introduction
This course explores the principles and practices of auditing and control within information systems. Students will examine frameworks and methodologies for assessing, managing, and monitoring risks associated with IT environments. Key topics include internal controls, audit planning, evidence collection, the evaluation of controls within computerized systems, regulatory and compliance requirements, and the use of computer-assisted audit tools. Emphasis is placed on the role of information systems in supporting organizational objectives, ensuring data integrity, and safeguarding assets through robust audit procedures and effective control mechanisms.
Recommended Textbook Information Technology Auditing 4th Edition by James Hall
Available Study Resources on Quizplus
12 Chapters
1122 Verified Questions
1122 Flashcards
Source URL: https://quizplus.com/study-set/1104
Page 2
Chapter 1: Auditing and Internal Control
Available Study Resources on Quizplus for this Chatper
100 Verified Questions
100 Flashcards
Source URL: https://quizplus.com/quiz/21726
Sample Questions
Q1) Control activities under SAS 109/COSO include
A) IT Controls, preventative controls, and Corrective controls
B) physical controls, preventative controls, and corrective controls.
C) general controls, application controls, and physical controls.
D) transaction authorizations, segregation of duties, and risk assessment
Answer: C
Q2) Which of the following indicates a strong internal control environment?
A) the internal audit group reports to the audit committee of the board of directors
B) there is no segregation of duties between organization functions
C) there are questions about the integrity of management
D) adverse business conditions exist in the industry
Answer: A
Q3) When planning the audit, information is gathered by all of the following methods except
A) completing questionnaires
B) interviewing management
C) observing activities
D) confirming accounts receivable
Answer: D
To view all questions and flashcards with answers, click on the resource link above.
Page 3
Chapter 2: Auditing IT Governance Controls
Available Study Resources on Quizplus for this Chatper
91 Verified Questions
91 Flashcards
Source URL: https://quizplus.com/quiz/21727
Sample Questions
Q1) What is the purpose of a data library?
Answer: A data libray is a room adjacent to the computer center that provides safe storage for the off-line data files. The files could be backups or current data files.
Q2) Which of the following is not an essential feature of a disaster recovery plan?
A) off-site storage of backups
B) computer services function
C) second site backup
D) critical applications identified
Answer: B
Q3) Certain duties that are deemed incompatible in a manual system may be combined in a computer-based information system environment.
A)True
B)False
Answer: True
Q4) Distributed data processing reduces the risk of operational inefficiencies.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above.
4
Chapter 3: Auditing Operating Systems and Networks
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/21728
Sample Questions
Q1) What is deep packet inspection?
Answer: DPI is a technique that searches individual network packets for protocol non-compliance and can identify and classify malicious packets based on a database of known attack signatures.
Q2) In an electronic data interchange (EDI) environment, when the auditor compares the terms of the trading partner agreement against the access privileges stated in the database authority table, the auditor is testing which audit objective?
A) all EDI transactions are authorized
B) unauthorized trading partners cannot gain access to database records
C) authorized trading partners have access only to approved data
D) a complete audit trail is maintained
Answer: C
Q3) What are the auditor's concerns in testing EDI controls?
Answer: When testing EDI controls, the auditor's primary concerns are related to ascertaining that EDI transactions are authorized, validated, and in compliance with organization policy, that no unauthorized organizations gain access to records, that authorized trading partners have access only to approved data, and that adequate controls are in place to maintain a complete audit trail.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 4: Auditing Database Systems
Available Study Resources on Quizplus for this Chatper
100 Verified Questions
100 Flashcards
Source URL: https://quizplus.com/quiz/21729
Sample Questions
Q1) All of the following are elements of the DBMS which facilitate user access to the database except
A) query language
B) data access language
C) data manipulation language
D) data definition language
Q2) The textbook refers to four interrelated components of the database concept. Which of the following is not one of the components?
A) the database management system
B) the database administrator
C) the physical database
D) the conceptual database
Q3) Which characteristic is not associated with the database approach to data management?
A) the ability to process data without the help of a programmer
B) the ability to control access to the data
C) constant production of backups
D) the inability to determine what data is available
Q4) The __________________________ authorizes access to the database.
Q5) What is the flat-file model?
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Systems Development and Program Change
Activities
Available Study Resources on Quizplus for this Chatper
94 Verified Questions
94 Flashcards
Source URL: https://quizplus.com/quiz/21730
Sample Questions
Q1) Which control is not associated with new systems development activities?
A) reconciling program version numbers
B) program testing
C) user involvement
D) internal audit participation
Q2) Discuss the three groups that participate in systems development.
Q3) Which step is least likely to occur when choosing a commercial software package?
A) a detailed review of the source code
B) contact with user groups
C) preparation of a request for proposal
D) comparison of the results of a benchmark problem
Q4) List three methods used to control the source program library.
Q5) Explain an advantage of surveying the current system when preparing a systems analysis for a new systems project.
Q6) When determining the operational feasibility of a new system, the expected ease of transition from the old system to the new system should be considered.
A)True
B)False
Q7) What is a systems selection report?
7
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Transaction Processing and Financial Reporting
Systems Overview
Available Study Resources on Quizplus for this Chatper
98 Verified Questions
98 Flashcards
Source URL: https://quizplus.com/quiz/21731
Sample Questions
Q1) Risk exposures in the General Ledger and Financial Reporting Systems include all of the following except
A) loss of the audit trail
B) unauthorized access to the general ledger
C) loss of physical assets
D) general ledger account out of balance with the subsidiary account
Q2) What is destructive update?
Q3) The coding scheme most appropriate for a chart of accounts is
A) sequential code
B) block code
C) group code
D) mnemonic code
Q4) Document flowcharts are used to represent systems at different levels of detail.
A)True
B)False
Q5) What are the reasons companies use coding schemes in their accounting information systems?
Q6) An inverted triangle with the letter "N" represents a file in "name" order. A)True B)False Page 8
To view all questions and flashcards with answers, click on the resource link above.
Page 9
Chapter 7: Computer Assisted Audit Tools and Techniques
Available Study Resources on Quizplus for this Chatper
82 Verified Questions
82 Flashcards
Source URL: https://quizplus.com/quiz/21732
Sample Questions
Q1) The firm allows no more than 10 hours of overtime a week. An employee entered "15" in the field. Which control will detect this error?
Q2) All of the following are disadvantages of the test data technique except
A) the test data technique requires extensive computer expertise on the part of the auditor
B) the auditor cannot be sure that the application being tested is a copy of the current application used by computer services personnel
C) the auditor cannot be sure that the application being tested is the same application used throughout the entire year
D) preparation of the test data is time-consuming
Q3) Risk exposures associated with creating an output file as an intermediate step in the printing process (spooling) include all of the following actions by a computer criminal except
A) gaining access to the output file and changing critical data values
B) using a remote printer and incurring operating inefficiencies
C) making a copy of the output file and using the copy to produce illegal output reports
D) printing an extra hardcopy of the output file
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 8: Data Structures and Caatts for Data Extraction
Available Study Resources on Quizplus for this Chatper
81 Verified Questions
81 Flashcards
Source URL: https://quizplus.com/quiz/21733
Sample Questions
Q1) The deletion anomaly is the least important of the problems affecting unnormalized databases.
A)True
B)False
Q2) View integration combines the data needs to all users into a single-entity wide schema.
A)True
B)False
Q3) Which statement is not true? Embedded audit modules
A) can be turned on and off by the auditor.
B) reduce operating efficiency.
C) may lose their viability in an environment where programs are modified frequently.
D) identify transactions to be analyzed using white box tests.
Q4) Which characteristic is associated with the database approach to data management?
A) data sharing
B) multiple storage procedures
C) data redundancy
D) excessive storage costs
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 9: Auditing the Revenue Cycle
Available Study Resources on Quizplus for this Chatper
97 Verified Questions
97 Flashcards
Source URL: https://quizplus.com/quiz/21734
Sample Questions
Q1) Sales orders should be prenumbered documents.
A)True
B)False
Q2) Which control does not help to ensure that accurate records are kept of customer accounts and inventory?
A) reconcile accounts receivable control to accounts receivable subsidiary
B) authorize credit
C) segregate custody of inventory from record keeping
D) segregate record keeping duties of general ledger from accounts receivable
Q3) Which department prepares the bill of lading?
A) Sales
B) Warehouse
C) Shipping
D) Credit
Q4) Another name for the stock release form is the picking ticket.
A)True
B)False
Q5) What is a bill of lading?
Q6) What specific internal control procedure would prevent the sale of goods on account to a fictitious customer?
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Auditing the Expenditure Cycle
Available Study Resources on Quizplus for this Chatper
100 Verified Questions
100 Flashcards
Source URL: https://quizplus.com/quiz/21735
Sample Questions
Q1) The financial value of a purchase is determined by reviewing the A) packing slip
B) purchase requisition
C) receiving report
D) supplier's invoice
Q2) Which internal control is not an important part of the payroll system?
A) Supervisors verify the accuracy of employee time cards.
B) Paychecks are distributed by an independent paymaster.
C) Accounts payable verifies the accuracy of the payroll register before transferring payroll funds to the general checking accounting.
D) General ledger reconciles the labor distribution summary and the payroll disbursement voucher.
Q3) In a computerized system that uses an economic order quantity (EOQ) model and the perpetual inventory method, who determines when to reorder inventory?
A) the inventory control clerk
B) the purchasing department
C) the vendor
D) the computer system
Q4) Name two major benefits of automating the purchasing effort.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 11: Enterprise Resource Planning Systems
Available Study Resources on Quizplus for this Chatper
90 Verified Questions
90 Flashcards
Source URL: https://quizplus.com/quiz/21736
Sample Questions
Q1) Which of the following is usually not part of an ERP's OLAP applications?
A) logistics
B) decision support systems
C) ad hoc analysis
D) what-if analysis
Q2) How are OLTP and OLAP different? Give examples of their use.
Q3) Which statements about data warehousing is not correct?
A) The data warehouse should be separate from the operational system.
B) Data cleansing is a process of transforming data into standard form.
C) Drill-down is a data-mining tool available to users of OLAP.
D) Normalization is an requirement of databases included in a data warehouse.
Q4) Separating the data warehouse from the operations databases occurs for all of the following reasons except
A) to make the management of the databases more economical
B) to increase the efficiency of data mining processes
C) to integrate legacy system data into a form that permits entity-wide analysis
D) to permit the integration of data from diverse sources
Q5) What is meant by the OLAP term "slicing and dicing"?
Q6) What is SCM software?
Q7) What are the basic stages of the data warehousing process?
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 12: Business Ethics, Fraud, and Fraud Detection
Available Study Resources on Quizplus for this Chatper
84 Verified Questions
84 Flashcards
Source URL: https://quizplus.com/quiz/21737
Sample Questions
Q1) Situational pressure includes personal or job related stresses that could coerce an individual to act dishonestly.
A)True
B)False
Q2) Individuals who acquire some level of skill and knowledge in the field of computer ethics are involved in which level of computer ethics?
A) para computer ethics
B) pop computer ethics
C) theoretical computer ethics
D) practical computer ethics
Q3) What are the risk factors that relate to fraudulent financial reporting? What types of common schemes should auditors look for?
Q4) As a form of computer fraud, what is eavesdropping?
Q5) Computer fraud can take on many forms, including each of the following except
A) theft or illegal use of computer-readable information
B) theft, misuse, or misappropriation of computer equipment
C) theft, misuse, or misappropriation of assets by altering computer-readable records and files
D) theft, misuse, or misappropriation of printer supplies
To view all questions and flashcards with answers, click on the resource link above. Page 15